One-way encrypted filesystem